#####################################################################################
#
# quantcast_cookies.pl
#   Interpret Quantcast cookies* (parsing partially complete)
#   
# Plugin Author: Ryan Benson (ryan@obsidianforensics.com)
#
#####################################################################################

package quantcast_cookies;
use strict;

my %config = (friendlyName   => "Quantcast Cookie Parser",
              description    => "Parses Quantcast cookies",
              artifactType   => "cookie",
              remoteLookups  => 0,
              browser        => "Chrome",
              browserVersion => 19,
              version        => 20120611);

sub getConfig       { return %config; }
sub getFriendlyName { return $config{friendlyName}; }
sub getDescription  { return $config{description};; }
sub getArtifactType { return $config{artifactType}; }
sub getRemoteLookups{ return $config{remoteLookups}; }
sub getVersion      { return $config{version}; }

sub pluginmain{

    my $select_h = $::datastore->prepare(" SELECT rid,name,value,derived 
                                            FROM cookies 
                                            WHERE name='__qca'  ");

    my $update_h = $::datastore->prepare(" UPDATE cookies SET derived=? WHERE rid=? ");

    $select_h->execute();
    my $counter = 0;
    while (my @row = $select_h->fetchrow) {
        my $derived = $row[3];
        
        if ($row[1] eq "__qca"){
            if ($row[2]=~/(P0)-(\d+)-(\d{10,13})/){
                $derived = "Timestamp: " . ::EpochToHuman($3) . " | [Quantcast Cookie]";    
                $counter++;  }  
        }
        $update_h->execute( $derived, $row[0] );
    }
    ::printStatus("$counter cookies parsed");
}

1;